Redact a document: method, pitfalls and an offline tool
To redact a document is to black out the passages a reader must not see. The practice is old: the censors of imperial Russia blacked out newspaper columns with ink (the French word for it, caviarder, comes from there). Today it covers any removal of information from a written record, whether a court decision, a contract, a medical file or an expert report.
Reliable redaction works in the file's actual text, on every occurrence and down to the metadata. On this page we explain what sets redaction apart from pseudonymization and anonymization, what a complete redaction must cover, and how Biffer, our offline redaction software, masks personal data directly in the text while keeping the layout.
Redaction, pseudonymization, anonymization: three different operations
Key points
- Redacting means masking: the data is replaced by a neutral label ([PERSONNE]) and lost to the reader.
- Pseudonymizing means replacing it with a consistent alias (PERSONNE_001): the document stays usable, and re-identification remains possible with the table.
- Anonymizing means making re-identification impossible by reasonable means, irreversibly.
- Biffer performs these operations in the file's actual text: the original data truly disappears from the document produced.
The three words are often used interchangeably. Yet they describe different results, which the GDPR does not treat the same way. The table below sums up what each one does to the document and to the data.
| Operation | What "Marie Dupont" becomes | Reversible? | Is the document still usable? |
|---|---|---|---|
| Redaction (mask) | [PERSONNE] | No | Partly: two masked people carry the same label |
| Pseudonymization (alias) | PERSONNE_001 | Yes, with the mapping table | Yes: every occurrence carries the same alias |
| Anonymization | Data beyond the reach of any re-identification, with no table | No, by design | Yes, if the remaining data is enough for the task |
Redaction suits cases where only the substance matters afterwards: a published excerpt, a training example, a document handed to a third party who has no use for identities. Pseudonymization suits cases where the document must stay coherent, for example so that an AI can summarize a file involving three people while telling each of them apart. Anonymization in the strict sense is a more demanding goal, which we cover on the page anonymize a document, with guidance from the CNIL (the French data protection authority) and Recital 26 of the GDPR.
What a complete redaction takes care of
A document lives in its structure as much as in its appearance. A complete redaction therefore covers five points, which Biffer handles for you.
- The text itself. Biffer replaces the data in the file's content: the name disappears from the text, and a selection or a copy and paste returns the mask, and only the mask.
- Metadata. Author, company, title, comment authors, template name: these fields often reveal the firm, the department or the person who wrote the document. Biffer clears them in the file produced.
- Every occurrence. The name appears on page 2, in a footnote on page 9, in a table on page 14. Each item added in the preview is handled in all its occurrences at once.
- Indirect identifiers. Address, date of birth, social security number, license plate: these identify a person by cross-referencing. Biffer detects them just as it detects names, and the preview lets you complete the list.
- The file itself. Redaction happens on your computer, before anything is sent: the document stays in your hands from start to finish. We come back to this on the offline software page.
These five points share a common thread: acting on the file's content rather than its appearance. That is how Biffer works, on the text, on every occurrence and on the metadata, before letting you check the result.
Automatic redaction: what Biffer does, what you decide
Biffer is desktop software for Mac and PC (Windows) that runs entirely offline. It was designed by Romain Rissoan, a trainer and consultant based in Lyon, France. Automatic redaction prepares, you approve: it makes review quick, even on long documents.
The software analyzes the file on your computer and highlights the data it detects: people, email addresses, phone numbers, postal addresses, French company numbers (SIREN and SIRET), French social security numbers, IBANs, license plates, dates, and the fields specific to your profession (French bar locker number (toque), court case number (RG), RPPS health professional number, CRPCEN notary staff number, claim number, employee ID, EU VAT number, among others). You can add your own fields by keyword. In the preview, you untick false positives and add whatever is missing; each addition applies to all occurrences at once.
For each data type, you choose the policy: mask ([PERSONNE]), pseudonymize (PERSONNE_001) or keep. The text is then rewritten in place. In a PDF, this means the string is replaced directly in the file's objects; in a Word or Excel file, the formatting is kept. Metadata (author, company, comment authors) is cleared. How PDF redaction works in detail is described on the page redact a PDF.
Supported formats are PDF, Word (.docx), Excel (.xlsx), CSV and text (.txt, .md). Images and scanned PDFs, made only of images, go through built-in character recognition, offline, then are redacted by blacking out pixels, a permanent result. A queue lets you redact several files, in reviewed mode (you check each preview) or automatic mode. The complete process, step by step, is on the features page.
Mask or pseudonymize: choosing by use
The right policy depends on what you will do with the redacted document. Here are four common situations and the choice we recommend.
Submitting a file to an AI for a summary or analysis
Pseudonymize. The AI must be able to tell PERSONNE_001 from PERSONNE_002 to produce an accurate summary. The encrypted mapping table lets you restore the names in the answer. See prepare a document for AI.
Publishing an excerpt, an example or training material
Mask. Readers focus on the substance, and working without a table makes the operation permanent. This is redaction in the classic sense.
Sending a document to a provider who only needs the facts
Mask the people, keep the useful technical fields (dates, amounts) through the policy for each data type. Check in the preview that indirect identifiers are covered.
Building a set of reusable internal documents
Pseudonymize without a table, or mask. Either way, the result is permanent and the metadata is cleared.
In every case, the file stays on your computer during the operation. For professions bound by confidentiality (lawyers, notaries, accountants, healthcare professionals), this is the first condition of legitimate redaction; the professions pages detail the preset fields for each one. The reference legal framework remains the GDPR, whose full text is published on EUR-Lex (General Data Protection Regulation); Biffer prepares the document, you review it, and you have the final say on what you send.
Frequently asked questions
What is the difference between redacting and anonymizing a document?
Redacting a document means masking information: the name is replaced by a neutral label such as [PERSONNE], permanently. Anonymizing goes further: it means making any re-identification of the person impossible by reasonable means, including by cross-referencing with other data. In between sits pseudonymization, which replaces the data with a consistent alias (PERSONNE_001) and may or may not keep a mapping table. Biffer performs masking and pseudonymization; anonymization in the regulators' sense is a goal you reach by working without a table and reviewing the remaining content.
Is a black rectangle drawn in my PDF reader a reliable way to black out text?
Redaction is reliable when the underlying content is actually removed from the file and the document is then saved flattened. The "rectangle" or "annotation" tool in a PDF reader draws a shape over the text, which can still be selected, copied and indexed. Biffer rewrites the text in the file's objects, in every occurrence, and clears the metadata. To check a redaction, open the PDF produced, search for the original data and look at the document properties: its absence confirms the job is done.
Can I run automatic redaction on several files at once?
Yes. Biffer has a queue into which you drop several documents (PDF, Word, Excel, CSV, text). There are two modes. In reviewed mode, each file goes through the highlighted preview: you approve the detections, untick false positives and add whatever is missing before rewriting. In automatic mode, the policies chosen for each data type apply without an intermediate review, which suits consistent batches where the fields are well known. The automatic queue is part of the unlimited plan; on the free plan, the queue works in reviewed mode. In both modes, processing stays local: every file remains on the computer, and each document's metadata is cleared.
What happens to metadata when I redact with Biffer?
It is cleared. The author, company and comment author fields are erased in the document produced, for PDF as well as Word and Excel. This matters: a document whose names are masked and whose properties are cleared also protects the firm, the department and the writer. You can check the properties of the file produced before sending it: Biffer prepares, you approve, and you have the final say.
Your business documents anonymized, ready to be published or handed to an AI tool.
Biffer runs on your computer without sending a single file. Free for five files a month, unlimited for €10 excl. VAT per computer.
100% offline · Free: 5 files a month · No file sent